SYSTEM Cited by 3 sources
WhatsApp¶
WhatsApp is Meta's global end-to-end-encrypted messaging product. Default E2EE for personal messages and calls covers 3B+ users messaging daily (2026-01-27 Meta Engineering). WhatsApp is the host product for a cluster of Meta security and privacy systems on this wiki.
Security + privacy systems¶
- systems/whatsapp-wamedia — cross-platform media library, rewritten from C++ to Rust (90K LoC Rust vs 160K LoC C++); largest known client-side Rust deployment. (sources/2026-01-28-meta-rust-at-scale-an-added-layer-of-security-for-whatsapp)
- systems/whatsapp-kaleidoscope — WhatsApp's ensemble of media format-conformance, risk-indicator, file-type-spoof, and dangerous-type checks that run on top of wamedia before OS-library handoff.
- systems/whatsapp-private-processing — confidential-computing infrastructure letting WhatsApp invoke AI features over E2EE content without Meta or third parties seeing plaintext. (sources/2025-04-30-meta-building-private-processing-for-ai-tools-on-whatsapp)
- systems/whatsapp-advanced-chat-privacy — in-chat privacy controls (block export, auto-download, third-party integrations).
- systems/whatsapp-research-proxy — bug-bounty research proxy exposing WhatsApp's network protocol for external researchers.
- systems/whatsapp-e2ee-backups — E2EE backup feature for message history, composing user recovery code or passkey with the HSM Backup Key Vault.
- systems/whatsapp-hsm-backup-key-vault — the tamper-resistant HSM fleet (geographically distributed, majority-consensus replicated) that stores per-user backup keys inaccessibly to Meta. Substrate for E2EE backups. (sources/2026-05-01-meta-strengthening-end-to-end-encrypted-backups)
Adjacent Meta-wide security disciplines¶
- Key-transparency (tech.facebook.com, 2023)
- End-to-end encrypted backups (blog.whatsapp.com)
- Calling protections (engineering.fb.com, 2023)
- Bug Bounty program + published CVEs (whatsapp.com/security/advisories)
- Supply-chain management + automated attack-surface analysis
- CFI, hardened memory allocators, safer buffer-handling APIs for remaining C/C++ code
Seen in¶
- sources/2026-05-01-meta-strengthening-end-to-end-encrypted-backups — hardens the E2EE-backup substrate: adds OTA fleet-key distribution for Messenger (Cloudflare-signed + Meta-countersigned validation bundle with Cloudflare audit log); commits Meta to publishing deployment evidence on each new HSM-fleet rollover. Underlying vault (WhatsApp side) pre-existed since 2021-09-10.
- sources/2026-01-28-meta-rust-at-scale-an-added-layer-of-security-for-whatsapp — Rust-rewrite of wamedia; Kaleidoscope check ensemble; 2015 Stagefright forcing function.
- sources/2025-04-30-meta-building-private-processing-for-ai-tools-on-whatsapp — Private Processing confidential-compute infrastructure for AI features over E2EE content.